Windows Exchange Unified Messaging Process Drops Suspicious Files Indicating CVE-2021-26858

Alerts on Exchange Unified Messaging (UMWorkerProcess.exe) creating unusual files, excluding common benign names consistent with CVE-2021-26858 activity.

FreeUnreviewedSigmahighv1

windows-exchange-unified-messaging-process-drops-suspicious-files-indicating-cve-b06335b3

title: Windows Exchange Unified Messaging Process Drops Suspicious Files Indicating CVE-2021-26858
id: 8352a7a2-ce03-4040-b346-20cf4209573b
status: test
description: This rule flags file creation events where the process image ends with UMWorkerProcess.exe, excluding specific benign filename patterns. Such non-standard file creation by Exchange Unified Messaging can indicate attempts to drop web shells or other malicious payloads associated with CVE-2021-26858 exploitation. The detection relies on Windows file event telemetry capturing the creating process image and the target filename.
references:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26858/file_event_win_cve_2021_26858_msexchange.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-03-03
modified: 2022-10-09
tags:
  - attack.t1203
  - attack.execution
  - cve.2021-26858
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: UMWorkerProcess.exe
  filter:
    TargetFilename|endswith:
      - CacheCleanup.bin
      - .txt
      - .LOG
      - .cfg
      - cleanup.bin
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b06335b3-55ac-4b41-937e-16b7f5d57dfd
    type: derived

What it detects

This rule flags file creation events where the process image ends with UMWorkerProcess.exe, excluding specific benign filename patterns. Such non-standard file creation by Exchange Unified Messaging can indicate attempts to drop web shells or other malicious payloads associated with CVE-2021-26858 exploitation. The detection relies on Windows file event telemetry capturing the creating process image and the target filename.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.